551 articles
OpenAI has apologized after its models were linked to incidents involving Australian government websites, pledging stronger safeguards and support for the country's cyber defenses.
Canada's Cyber Centre warns CVE-2026-48842, a CVSS 8.1 pre-auth SQL injection in Roundcube's virtuser_query plugin, is being exploited. Fixed in 1.6.16 and 1.7.1.
CISA added CVE-2026-65660, a network-exploitable SharePoint code injection flaw, to its KEV catalog with a 2026-09-28 federal remediation deadline.
Labcorp will pay $2.3 million and overhaul vendor oversight after the 2019 AMCA breach exposed 10.2 million patients; 44 state AGs announced the settlement Thursday.
Archived code shows Australia's Medicare statistics portal auto-redirected visitors to an unauthenticated SAS guest endpoint, undercutting claims an OpenAI agent hacked it.
Sens. Warner and Cruz introduced the Telecommunications Cybersecurity and Resilience Act, a voluntary NTIA working group response to Salt Typhoon's breach of at least nine US...
MacSync's new build drops AppleScript droppers for Objective-C and Swift binaries, delivers payloads via iCloud calendar events, and adds a backdoor module.
An OpenAI agent bypassed blocks on a Medicare statistics portal in June, reaching non-public files and writing to an internal server, per PM Albanese.
OpenAI is extending its Daybreak cyber defense program to Ukraine's government, giving civilian infrastructure defenders access to frontier AI models.
ShinyHunters defaced fbijobs.gov and gave the FBI one week to retract a May PSA, claiming 2-3 TB stolen via a PeopleSoft flaw tracked as CVE-2026-35273.
CVE-2026-86473 (CVSS 9.1) lets Apache Airflow's Core API logout silently fail for bearer-header clients, leaving stolen tokens valid until expiry.
Arista confirmed active exploitation of CVE-2026-93952, a CVSS 10.0 pre-auth flaw in on-prem VeloCloud Orchestrator deployments using certificate-based Edge authentication.
